cycbot | 4fd07e4ba860cf2e651889e12511af622472194b80869ed10334d8575e4fcdb7

General

Target

d3077250c4e3349bc0d512030cf04469_JaffaCakes118.exe
Size

186KB
MD5

d3077250c4e3349bc0d512030cf04469
SHA1

b0c3ac8518b484100b9d61c43bf930a8f007c784
SHA256

4fd07e4ba860cf2e651889e12511af622472194b80869ed10334d8575e4fcdb7
SHA512

67bc93775488e743ff1d10f537eb25811d22915f03e4d0a21c349eb8b24540b4e42d3292877e1ac6a5c270b36f7470d0a1813faefcc9e3efc731e20066135eb4
SSDEEP

3072:UX7KBgA6xRQqW/w/8gT2ayPiN8IL6GTYgoL+gl3vY8Nf:UrKB96x5WuKiCInTal3vDf

Score

10^/10

cycbot backdoor discovery rat spyware stealer upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 4 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral1/memory/2952-15-0x0000000000400000-0x000000000044E000-memory.dmp	family_cycbot
behavioral1/memory/2700-16-0x0000000000400000-0x000000000044E000-memory.dmp	family_cycbot
behavioral1/memory/2232-78-0x0000000000400000-0x000000000044E000-memory.dmp	family_cycbot
behavioral1/memory/2700-154-0x0000000000400000-0x000000000044E000-memory.dmp	family_cycbot

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2700-2-0x0000000000400000-0x000000000044E000-memory.dmp	upx
behavioral1/memory/2952-13-0x0000000000400000-0x000000000044E000-memory.dmp	upx
behavioral1/memory/2952-15-0x0000000000400000-0x000000000044E000-memory.dmp	upx
behavioral1/memory/2952-12-0x0000000000400000-0x000000000044E000-memory.dmp	upx
behavioral1/memory/2700-16-0x0000000000400000-0x000000000044E000-memory.dmp	upx
behavioral1/memory/2232-77-0x0000000000400000-0x000000000044E000-memory.dmp	upx
behavioral1/memory/2232-78-0x0000000000400000-0x000000000044E000-memory.dmp	upx
behavioral1/memory/2700-154-0x0000000000400000-0x000000000044E000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d3077250c4e3349bc0d512030cf04469_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d3077250c4e3349bc0d512030cf04469_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d3077250c4e3349bc0d512030cf04469_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2700 wrote to memory of 2952	2700	d3077250c4e3349bc0d512030cf04469_JaffaCakes118.exe	30
PID 2700 wrote to memory of 2952	2700	d3077250c4e3349bc0d512030cf04469_JaffaCakes118.exe	30
PID 2700 wrote to memory of 2952	2700	d3077250c4e3349bc0d512030cf04469_JaffaCakes118.exe	30
PID 2700 wrote to memory of 2952	2700	d3077250c4e3349bc0d512030cf04469_JaffaCakes118.exe	30
PID 2700 wrote to memory of 2232	2700	d3077250c4e3349bc0d512030cf04469_JaffaCakes118.exe	32
PID 2700 wrote to memory of 2232	2700	d3077250c4e3349bc0d512030cf04469_JaffaCakes118.exe	32
PID 2700 wrote to memory of 2232	2700	d3077250c4e3349bc0d512030cf04469_JaffaCakes118.exe	32
PID 2700 wrote to memory of 2232	2700	d3077250c4e3349bc0d512030cf04469_JaffaCakes118.exe	32

C:\Users\Admin\AppData\Local\Temp\d3077250c4e3349bc0d512030cf04469_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\d3077250c4e3349bc0d512030cf04469_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2700
- C:\Users\Admin\AppData\Local\Temp\d3077250c4e3349bc0d512030cf04469_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\d3077250c4e3349bc0d512030cf04469_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\Microsoft\conhost.exe%C:\Users\Admin\AppData\Roaming\Microsoft
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2952
- C:\Users\Admin\AppData\Local\Temp\d3077250c4e3349bc0d512030cf04469_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\d3077250c4e3349bc0d512030cf04469_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\dwm.exe%C:\Users\Admin\AppData\Roaming
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2232

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\F609.7C4

Filesize
1KB

MD5
10670d3d8f68b235ee06e7b143eae11c

SHA1
af45f4969f29c917e696018f9d1cdc82d300fdf9

SHA256
1a4db38debb7adc5b8a886f478f8bf880fbf4b2815142f9f34041af201a3d01d

SHA512
b707a5b758a2324d6e2168fd3e6ae54ce060d4b310730ab41cbab4307c81e5ea5bc47120d8eaf3331d9eb99c7b996bbbc970a3823e5ff87cddff707d8206c1a9

Download Submit
C:\Users\Admin\AppData\Roaming\F609.7C4

Filesize
600B

MD5
723918ff1885cb4de2a0a014ad84b0f7

SHA1
94589fc9087b2b12911a09756459ef46605d05d0

SHA256
2f393b2555f5c72372c8680006c03be667fd1c46079712d56ece71b830f746a8

SHA512
525aeed87a1552431752bbbaf1c3081b514d3c9cd01e3531c70edd38dbf1aed33729b070b8e2197c5255380acac871ebd9aa8253c8f4312104937e3ea0899d57

Download Submit
C:\Users\Admin\AppData\Roaming\F609.7C4

Filesize
996B

MD5
ce26391ce3b5ce24038a10020af2f15e

SHA1
d5bc2e8e8b6d4858ff7017562bf4b1f366602919

SHA256
742bb237412c32e3cb8c4fb819b08e2b8918fdc13693d2f9b4e97218026ea3d0

SHA512
a74fd63c0248f80a58dd5057e0c19147f73c557b372c74f2ba6a6c78a07aca5a83a35124343349ca02e8a8e600561095857d1b0c1c240ca5a685f9465cea28f1

Download Submit
memory/2232-77-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/2232-78-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/2700-1-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/2700-2-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/2700-16-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/2700-154-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/2952-13-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/2952-15-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/2952-12-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download

Analysis

Sharing